A healthcare startup stores sensitive patient genomic data in an Amazon S3 bucket. The startup must grant read-only access to specific genomic data files to a third-party research group operating in a separate AWS account that is outside the startup's AWS organization. Currently, all data in the S3 bucket is unencrypted. The compliance team mandates that all files must be encrypted at rest using customer-managed keys (CMKs) to ensure complete auditability of key access, and that the external researchers must be able to securely decrypt and retrieve the files. Which combination of actions must the Solutions Architect perform to implement this configuration? (Select TWO.)
- Create a customer-managed KMS key in the startup's account, configure its key policy to delegate permissions to the startup's root account, and explicitly add a statement to the key policy that grants the external research role permission to perform the kms:Decrypt action.Cevap
- Apply a bucket policy to the startup's S3 bucket that grants the external research role permission to perform s3:GetObject, and configure the IAM policy of the external research role to allow both s3:GetObject on the startup's bucket and kms:Decrypt on the customer-managed KMS key.Cevap
- CConfigure the S3 bucket to use the default AWS-managed KMS key (aws/s3) for encryption, and update the bucket policy to grant the external research role read access to the bucket.
- DAttach a Service Control Policy (SCP) to the Organizational Unit (OU) level of the startup's organization that explicitly permits cross-account kms:Decrypt and s3:GetObject access to the external research role's ARN.
- EUpdate the S3 bucket policy to grant both s3:GetObject and kms:Decrypt permissions to the external research role, bypassing the need to modify the KMS key policy.
Cevap
Create a customer-managed KMS key and allow the external role decryption permissions in the key policy, then configure the S3 bucket policy to grant object retrieval access and have the external IAM policy permit both actions.
To share S3 objects encrypted with KMS cross-account, a customer-managed KMS key must be used. The key policy must be updated to allow the external account or role to perform the decryption operation. In addition, the S3 bucket policy must allow the external role retrieval permissions, and the IAM policy of the external role must explicitly allow both retrieval and decryption actions on the respective resources.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access to encrypted S3 resources requires a customer-managed KMS key, a key policy that permits the external entity to perform decryption, an S3 bucket policy permitting read access, and local IAM policies in the external account enabling both actions.
Tahmini Süre:2m 0s